Guidelines and Limitations for Interfaces

VLAN Subinterfaces

• This document discusses FXOS VLAN subinterfaces only. You can separately create subinterfaces within the threat defense application. See FXOS Interfaces vs. Application Interfaces for more information.

• Subinterfaces (and the parent interfaces) can only be assigned to container instances.

  Note	If you assign a parent interface to a container instance, it only passes untagged (non-VLAN) traffic. Do not assign the parent interface unless you intend to pass untagged traffic. For Cluster type interfaces, the parent interface cannot be used.

• Subinterfaces are supported on Data or Data-sharing type interfaces, as well as Cluster type interfaces. If you add subinterfaces to a Cluster interface, you cannot use that interface for a native cluster.

• For multi-instance clustering, FXOS subinterfaces are not supported on Data interfaces. However, subinterfaces are supported for the cluster control link, so you can use either a dedicated EtherChannel or a subinterface of an EtherChannel for the cluster control link. Note that application-defined subinterfaces are supported for Data interfaces.

• You can create up to 500 VLAN IDs.

• See the following limitations within the logical device application; keep these limitations in mind when planning your interface allocation.

  • You cannot use subinterfaces for an threat defense inline set or as a passive interface.

  • If you use a subinterface for the failover link, then all subinterfaces on that parent, and the parent itself, are restricted for use as failover links. You cannot use some subinterfaces as failover links, and some as regular data interfaces.

Data-sharing Interfaces

• You cannot use a data-sharing interface with a native instance.

• Maximum 14 instances per shared interface. For example, you can allocate Ethernet1/1 to Instance1 through Instance14.

  Maximum 10 shared interfaces per instance. For example, you can allocate Ethernet1/1.1 through Ethernet1/1.10 to Instance1.

  

• You cannot use a data-sharing interface in a cluster.

• See the following limitations within the logical device application; keep these limitations in mind when planning your interface allocation.

  • You cannot use a data-sharing interface with a transparent firewall mode device.

  • You cannot use a data-sharing interface with threat defense inline sets or passive interfaces.

  • You cannot use a data-sharing interface for the failover link.

Inline Sets for Threat Defense

• Supported for physical interfaces (both regular and breakout ports) and EtherChannels. Subinterfaces are not supported.

• Link state propagation is supported.

• Do not enable Hardware Bypass and link state propagation for the same inline set.

Hardware Bypass

• Supported for the threat defense; you can use them as regular interfaces for the ASA.

• The threat defense only supports Hardware Bypass with inline sets.

• Hardware Bypass-capable interfaces cannot be configured for breakout ports.

• You cannot include Hardware Bypass interfaces in an EtherChannel and use them for Hardware Bypass; you can use them as regular interfaces in an EtherChannel.

• Hardware Bypass is not supported with High Availability.

• Do not enable Hardware Bypass and link state propagation for the same inline set.

Default MAC Addresses